PT-2023-23398 · Unknown · Cu/Silicon

Name of the Vulnerable Software and Affected Versions: cu/silicon version a9ef36 Description: The issue is a reflected cross-site scripting XSS vulnerability. It occurs via the User Input field, allowing potential attackers to inject malicious scripts. Recommendations: For cu/silicon version...

CVE-2023-31584: Improper Neutralization of Input During Web Page Generation

GitHub repository cu/silicon commit a9ef36 was discovered to contain a reflected cross-site scripting XSS vulnerability via the User Input field...

CVE-2023-31584

GitHub repository cu/silicon commit a9ef36 was discovered to contain a reflected cross-site scripting XSS vulnerability via the User Input field...

TOTOLINK A7100RU 操作系统命令注入漏洞

TOTOLINK A7100RU is a wireless router from China's Gion Electronics TOTOLINK. A security vulnerability exists in TOTOLINK A7100RU version V7.4cu.2313B20191024, which stems from a command injection vulnerability in that an attacker can obtain a stable root shell via a specially crafted payload...

cu-tipaza.dz Cross Site Scripting vulnerability OBB-3283056

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

libdwarf:fuzz_die_cu_attrs: Invalid-free in fuzz_die_cu_attrs.c

Project: https://github.com/davea42/libdwarf-code.git Detailed Report: https://oss-fuzz.com/testcase?key=4845537731149824 Project: libdwarf Fuzzing Engine: afl Fuzz Target: fuzzdiecuattrs Job Type: aflasanlibdwarf Platform Id: linux Crash Type: Invalid-free Crash Address: 0x604000000165 Crash...

Malicious Package

Overview cu-dashboard-components is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this...

TOTOLINK A7100RU 操作系统命令注入漏洞

The TOTOLINK A7100RU is a wireless router from China's Gion Electronics TOTOLINK. An operating system command injection vulnerability exists in the TOTOlink A7100RU V7.4cu.2313B20191024 version, which stems from the rsabits parameter of the set/delStaticDhcpRules method containing a command...

Malicious code in cu-dashboard-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 05a7db61863c75c4e403ac8634e0889a3980b57447fb6c65a10f21724a064fe1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-219 Malicious code in cu-dashboard-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 05a7db61863c75c4e403ac8634e0889a3980b57447fb6c65a10f21724a064fe1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

VDA upgrade service fails when upgrading CU version

VDA does not upgrade when upgrading to next CU version. In Studio the upgrade starts, goes into In-Progress and moves to completed however, the installed version does not change. After a minute or two, the status moves back to upgrade available...

TOTOLINK A860R 安全漏洞

The TOTOLINK A860R is a wireless router from China's Gion Electronics TOTOLINK. A security vulnerability exists in the TOTOLINK A860R version V4.1.2cu.5182B20201027, which originates from an unfiltered parameter in infostat.cgi, resulting in a buffer overflow...

cu-maghnia.edu.dz Cross Site Scripting vulnerability OBB-2888592

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

TOTOLINK A800R 信任管理问题漏洞

The TOTOLINK A800R is a wireless router from China's Gion Electronics TOTOLINK. A security vulnerability exists in the TOTOLINK A800R version V4.1.2cu.5137B20200730, which originates from the inclusion of a hardcoded password for root in /etc/shadow.sample...

CVE-2021-42321

Microsoft Exchange Server Remote Code Execution Vulnerability Recent assessments: gwillcox-r7 at November 21, 2021 5:55pm UTC reported: A PoC for this vulnerability is now available at https://gist.github.com/testanull/0188c1ae847f37a70fe536123d14f398. There is also a Metasploit module at...

CVE-2021-22907

An improper access control vulnerability exists in Citrix Workspace App for Windows potentially allows privilege escalation in CR versions prior to 2105 and 1912 LTSR prior to CU4...

PT-2021-15264 · Citrix · Citrix Workspace App For Windows

Name of the Vulnerable Software and Affected Versions: Citrix Workspace App for Windows versions prior to 2105 Citrix Workspace App for Windows 1912 LTSR prior to CU4 Description: An improper access control issue potentially allows privilege escalation. Recommendations: For versions prior to 2105...

Arbitrary file reading vulnerability in the cu***.php interface of the background of the Tianqing security isolation and information exchange system

Tianqing Security Isolation and Information Exchange System is the access control switch equipment with network isolation technology independently developed by Qixing Information Technology Co., Ltd, which provides high security isolation protection for key data. There is an arbitrary file readin...

SQL Injection Vulnerability in Cu***.aspx Page of Huigao OA Office System

Chengdu Huigao Software Co., Ltd. is an OA software developer and service provider. There is a SQL injection vulnerability in the Cu.aspx page of the Huigao OA office system, which can be exploited by attackers to obtain sensitive information from the database...

KLA11402 Spoofing vulnerability in Microsoft Office

Spoofing vulnerability was found in Microsoft Office. Malicious users can exploit this vulnerability remotely via specially crafted request to spoof user interface. Original advisories CVE-2019-0624 Exploitation Related products Microsoft-Lync Microsoft-Office CVE list CVE-2019-0624 warning KB li...